Repository navigation
Vulnerability: Prototype Pollution via the main (merge) function #963
Description
Description
Found by vulnerability check OWASP:UsingComponentWithKnownVulnerability
Filename: merge:2.1.1 | Reference: CVE-2021-23397 | CVSS Score: 9.8 | Category: CWE-1321 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
dependency tree:
commitizen@4.2.6
└ find-node-modules@2.1.3
└ merge@2.1.1
caused by callumacrae/find-node-modules#18
awaiting fix to upgrade to find-node-modules@2.1.4
Steps to reproduce
- Clone this repo
- Install dependencies
npm i - observe vulnerability
Environment
- commitizen@4.2.6
Wrongly raised in commitizen-tools/commitizen#654
Activity
callumacrae commentedon Jan 11, 2023
Happy to merge the PR on find-node-modules but wanted to raise something here first - commitizen is as far as I can tell the only significant project using find-node-modules, and I'm not using it anymore either. Would the maintainers of commitizen be happy / willing to take ownership of the module? Happy to transfer ownership on both github and npm if so!
Alternatively, I believe from looking in the past that it should be pretty easy to rewrite out the dependency, and then I can archive the project :)
rkristelijn commentedon Jan 11, 2023
DariusSeputisCoH commentedon Dec 13, 2024
commitizen still uses find-node-modules what uses vulnerable merge package, any plans on fixing it ?
mheob commentedon Jun 25, 2025
Any plans on fixing it?
We aren't anymore allowed to use this tools until this vulnerability is fixed.